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The Examiner has rejected Claims 1, 9, and 17 under 35 U.S.C. 1 12, second 
paragraph, as being indefinite. Specifically, the Examiner has taken issue with the phrase 
"more through." Applicant respectfiilly disagrees with this rejection. Specifically, it is 
clear from the claim language itself as to what "more tliorough" refers, namely a 
comparison between the claimed malware scanning and the claimed on-access scanning. 
Further, applicant relies on the plain and ordinary meaning of the term 'thorough," as 
evidenced by the exemplary dictionary definition below: 

thorough 

adj, 

• Exhaustively complete: a thorough search. 

• Pamstakingly accurate or careflil: thorough research. 

• Absolute; utter: a thorough pleasure. 

The American Heritage® Dictionary of the English Language, Fourth Edition 
Copyright © 2000 by Houghton Mifflin Company 
Published by Houghton Mifflin Company. All rights reserved 

The Examiner has rejected Claims 1, 8, 9, 16, 17, 24, and 27 under 35 U.S.C. 
103(a) as being unpatentable over Cozza (U.S. Patent No. 5,502,8 15) in view of Chess et 
al. (U.S. Patent No. 6,772,346), Hruska (Vims Detection), and Ellenberger (U.S. Patent 
No. 5,684,875). Applicant respectfully disagrees with such rejection, especially in view 
of the amendments made hereinabove to each of the independent claims. 

With respect to each of the independent claims, the Examiner has relied on item 
58 "no" and item 62 in Figure 4 of Cozza to make a prior art showing of applicant's 
claimed technique where "if no computer files containing malware are found in said 
storage location, then identifying said storage location as a clean storage location" (see 
this or similar, but not necessarily identical language in each of the independent claims). 
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Applicant respectfully asserts that the cache file technique disclosed by Cozza 
Figure 4 simply does not meet applicant's claimed "clean storage area.'' With reference 
to Figure 4, Cozza teaches that "[i]f no viruses were found in the file, then the file's scan 
information is added to the nev^ cache in step 62" (Cozza, Col. 5, lines K3). In this 
excerpt, Coz^a describes a method of updating a cache file if there are not any viruses 
found in the file. If all files were virus free, for example, the cache would contain 
information on every file. However, having a complete file cache does not imply that 
the entire cache represents "a clean storage location," as claimed by applicant In 
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particular, the file cache, as disclosed by Cozza, operates on individual files whereas 
applicant claims "clean storage locations " (emphasis added). 

In addition, the Examiner has relied on item 40 in Figure 4 of Cozza to make a 
prior ait showing of applicant's claimed technique of". . . subsequently reading a 
computer file, [andj determining whether or not said computer file is stored within a 
clean storage location ..." (see the same or similar, but not necessarily identical language 
in each of the independent claims - emphasis added). 

Applicant respectfully asserts that the Cozza excerpt relied upon by the Examiner, 
by virtue of the file details in the cache file, merely indicate whether the file is infected or 
not. Having the file details in a cache file simply does not even suggest that "... said 
computer file is stored within a clean st orage location " (emphasis added), as claimed. 
Thus, Cozza fails to meet applicant' s claimed language. 

Still with respect to each of the independent claims, the Examiner has relied on 
item 320 and item 330 in Figme 3 of Chess to make a prior art showing of applicant's 
claimed technique where "if said computer file is not stored within a clean storage 
location, then malware scanning [is performed on] said computer file" (see the same or 
similar, but not necessarily identical language in each of the independent claims)! 
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Applicant respectfully asserts that above reference from Chess as relied upon by 
the Examiner teaches checking a suspect file to determine if it is malicious. Chess, 
however, fails to even suggest a scanning technique specifically conditioned on whether 
". . . said computer file is not stored within a cl Ban storage location » (emphasis added), 
as claimed. Chess simply makes no mention of a location of a file being checked, as 
specifically claimed, and scanning as a function of such location. 

Still yet, the Examiner relied upon the following Figure 1 and Col. 8, lines 51-54 
in Ellenberger to make a prior art showing of applicant's claimed technique "wherein 
said step of malware scanning all computer files stored within a storage location as a 
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background task is performed with more thorough scanning options selected than for on- 
access scanning applied to computer files not stored within clean storage locations and 
being accessed by a user" (see the same or similar, but not necessarily identical language 
in each of the independent claims). 
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step 4 1 Select some detection algorithms of the fast group and 
some of the thorough, but slow executing group." (Bllenbercier 
Col. 5, lines 25-2$) ' 



Applicant respectfully as$erts that the figure and excerpt from EUenberger listed 
above teaches a method of randomJy selecting a mix of fast execution and slow execution 
virus detection algorithms for each scan. EUenberger does not teach applicant's claimed 
technique "wherein said step of raalware scanning all computer files stored within a 
storage location as a background tagk is perfonned with more thorough scanning options 

than for on-access scanning applied to computer files not stored within nla^p 
storage locations and being accessed by a user" (emphasis added), as claimed. 
EUenberger simply does not even mention using different scanning options for 
background task scanning versus on-access scanning, as claimed. 



PAGE 15/18 * RCVD AT 5/1SI2006 4:29:24 PM [Eastern Daylight rime] * SVR:USPTO-EFXRF-5/2 ' DNIS:2738300 ' CSID:4I)89714660 * DURATION (mm'SS):04-14 



MAY. 15. 2006 1:42PM 



ZILKA-KOTAB, PC 



NO. 2943 P. 



-13- 

To establish ^ prima facie case of obviousness, three basic criteria must be met. 
First, there must be some s^iggestion or motivation, either in the references themselves or 
in the knowledge generally available to one of ordinary skill in the art, to modify the 
reference or to combine reference teachings. Second, there must be a reasonable 
expectation of success. Finally, the prior art reference (or references when combined) 
must teach or suggest all the claim limitations. The teaching or suggestion to make the 
claimed combination and the reasonable expectation of success must both be found m the 
prior art and not based on applicant's disclosure, bi re Vaeck.947 F.2d 488, 20 USPQ2d 
1438 (Fed.Cir. 1991). 



Applicant respectfully asserts that at least the third element of the prima facie 
case of obviousness has not been met. since the priof art references, when combined, fail 
to teach or suggest all of the claim limitations, as noted above. Nevertheless, despite 
such paramount deficiencies and in the spirit of expediting the prosecution of the present 
application, applicant has amended each of the independent claims, as follows: 

"a background tasl< that occurs a s a fimction of when an assnr.iatpH 
computer svstem is at least substantiallv idlft " (emphasis added - see this or 
similar, but not necessarily identical language in each of the independent claims). . 

The Examiner relies upon Page 129, Col. 2 of Hruska to make a prior art showing 
of applicant's claimed technique "wherein said step of malware scanning all computer 
files stored within a storage location is performed as a background task." In view of the 
amendments made to each of the independent claims, as indicated above, Hruska's on. 
access scanner simply fails to meet applicant's claim language. Specifically, the 
Examiner has argued that «intercept[ing] file open and file close operations" constitutes a 
background task. However, the background task, as now claimed by applicant, requires a 
task "that occurs as a function of when an ass ociated comp n ter svstem is at laasif 
substantiallv idle " (emphasis added). In view of such additional distinction, Hruska 
clearly fails to meet applicant's claimed technique. 
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Applicant further notes that the prior art is also deficient with respect to the 
dependent claims. For example, with respect to Claim 7 et al., the Examiner has rejected 
the same under 35 U.S.C. 103(a) as being unpatentable over Cozza (U.S. Patent No. 
5.502,815) in view of Chess et al. (U.S. Patent No. 6,772,346), Hruska (Virus Detection), 
Eilenberger (U.S. Patent No. 5,684,875). Polk et al, Davidson et al., and Vignoles et al. 
(U.S. Patent No. 6,938,161). Specifically, the Examiner has relied on the following 
excerpts from Vignoles to make a prior art showing of applicant's claimed "wAerein, 
when said storage area is being malware scanned with said updated malware definition 
data, computer files written to said storage location after said storage location was 
previously identified as a clean storage location are malware scanned before computer 
files that are unaltered since said storage location was previously identified as a clean 
storage location." 



*lf a scan is required, then processing proceeds to step 16 at 
which the selected and ordered drivers produced from steps 4 and 
6 are applied in their priority order. During the scanning that 
takes place at Step IS, an early terminate request can be 
received, for example by a user cancelling the scanning process 
or by an automatic time-out, but the priority ordering carried 
out at step 6 will have ensured ttiAt at Xeaet the highest threat 
vxruses will have been scazued for." (Vignoles, Col. 3, lines 44- 
52) 

Applicant respectfiiily asserts that Vignoles' ordered drivers refer to the order in 
which the viruses are scanned for within a single file. Vignoles does not, however, even 
suggest that "computer files written to said storage ... are malware scanned before 
cpmputer files that ar$ \inaltgred since said storage location was previously identified 
clean storage location" (emphasis added), as claimed. Vignoles tlius clearly fails to 
disclose any technique that relates to the order in which computer files are scanned, as 
specifically claimed. 



as a 



Thus, a notice of allowance or specific prior art showing of each of the foregoing 
claim elements, in combination with the remaining claimed features, is respectfully 
requested. 
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Still yet, applicant brings to the Examiner's attention the subject matter of new 
Claim 28 below, which is added for full consideration: 



Thus, all of the independent claims are deemed allowable. Moreover, the 
remaining dependent claims are further deemed allowable, in view of their dependence 
on such independent claims. 

In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) 505-51 00. The 
Commissioner is authorized to charge any additional fees or credit any overpayment to 
Deposit Account No. 50-1351 (Order No. NAI1P496). 



"wherein the background task avoids interference with a responsiveness of 
the computer system when the user starts to use the computer system" (see 
Claim 28). 



P,0, Box 721120 

San Jose, CA 95172-1120 

408-505-5100 




Re^actfiiUy submitted, 
2ilkaMCotabi PC, 



igi^ation No. 41,429 
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